MakeetMakeet / Meaningtech
Privacy
Last updated: 21 October 2026
This notice explains how Makeet handles information in the app, account service, website and support. During development, account features become available only after service checks. You can use the local archive without an account.
Who is responsible
Titolare: Sebastiano Cataudo, operante con il nome commerciale Meaningtech. Contatto: support@makeet.app
Country of the primary account server
Italy
Information and purposes
Without sign-in, habits, quantities, activity times, statistics and planning stay in the app archive on your device. With an account, we store your provider identifier, email supplied by Apple or Google, and habits and activity entries you synchronize, including names, icons, targets, units, times and time zones. We use these to provide your private archive and sync across your devices. We do not receive your Apple or Google password. You can add a private display name and profile photo, synced with your account. On the first Google sign-in we may use the name and image supplied by Google; Apple does not supply a photo. You can change or remove it. The system picker reads only your selected image, which we resize and strip of metadata before storage. The profile is not public and is deleted with the account. The habit names and quantities you choose may describe wellness or exercise routines. These are user-entered details; Makeet does not read HealthKit or motion-sensor records. If you choose username and password, we store your username, verified recovery email and an Argon2id password hash, never a plaintext password. Verification and recovery codes expire after 15 minutes and are stored only as hashes with bounded attempts. Password recovery revokes existing sessions. Adding credentials to an existing account requires signing into that account and verifying the recovery email; matching email addresses never merge accounts automatically.
Calendars and planning
Calendar access is optional. The app reads only the device calendars you select to calculate availability, and writes an event only after your confirmation. Calendar events, attendees and calendar credentials are not uploaded to the Makeet backend. The calendar provider configured on your device may synchronize events under its own settings. The planner runs on the device using habit settings and past logging times; no external AI service receives this information. A direct Google Calendar connection is not currently provided.
Notifications
Notifications require device permission. When signed in, the service stores an installation identifier, an encrypted Apple push token, language, time zone and your optional reminder time. It uses synchronized progress to decide whether a daily reminder is needed. Alerts contain generic text, not habit names or quantities. The service records sending attempts, Apple acceptance and a receipt when the app sees or you open a notification. You can disable reminders in the app or notifications in device settings.
Legal grounds and choices
Providing accounts, synchronization and requested support is necessary to perform the service you request (GDPR Article 6(1)(b)). Optional calendar access and notifications are used following your choice and device permission; where consent is the legal basis, you may withdraw it at any time (Article 6(1)(a)). Security, abuse prevention and essential technical operation rely on legitimate interests (Article 6(1)(f)); you may object. Without identity information, we cannot create an account, but the local archive remains available. Optional permissions are not required for local habit tracking.
Service providers and international processing
Cloudflare provides HTTPS protection and email routing; DigitalOcean hosts the traffic relay. Apple provides sign-in and push delivery. Google provides sign-in and processes support email. These services receive information needed for their respective roles, and may process it outside the European Economic Area, including the United States. Cloudflare describes the Data Privacy Framework and Standard Contractual Clauses in its DPA; Apple and Google describe their transfer safeguards in the policies linked below. Contact support@makeet.app for information about applicable safeguards. We do not sell personal data, use advertising trackers, or share habits for advertising. If you choose Google sign-in, its SDK also declares collection of phone information, approximate location, identifiers, other usage data and other technical data. Google uses identifiers, usage data and other technical data for its own analytics as described in its privacy policy. Makeet receives only the identity and profile information needed for your account; it does not request phone or location permissions. The Google SDK does not receive your habit archive from Makeet. Resend sends the verification and recovery emails you request. It receives your recovery email address and the verification message, including its temporary code; it does not receive your password or habit archive. Its privacy and data-processing terms are linked below.
Retention and deletion
Synchronized data and revision history are retained until account deletion. Successful account deletion removes account data and active sessions from the service; Apple authorization is revoked before deletion is confirmed. If provider revocation fails, deletion is not reported as complete and can be retried. Session authorization expires within 30 days; access tokens within 15 minutes. Push delivery records are retained for up to 30 days. Restricted backups rotate within 30 days. Support messages are retained for resolving the request and any necessary legal obligations; security records only while needed for protection and investigation. Removing a server account does not erase a separate local archive, existing calendar events or another device’s offline copy. Username/password credentials are removed with the account. Expired verification requests and abuse-prevention counters are removed during subsequent authentication requests; expired codes cannot be used.
Security and local storage
Connections use HTTPS. Account stores are separated by user; service tokens use device-only Keychain storage and push/provider tokens are encrypted on the server. Synchronized habit data is processed by the backend and is not end-to-end encrypted. The app and widgets use local storage for their functions. The website has no advertising or analytics scripts; infrastructure may use essential security mechanisms.
Your rights and contact
Write to support@makeet.app to request access, correction, deletion, restriction, portability, or to object to processing where applicable. We may need proportionate identity verification. You may withdraw consent without affecting earlier lawful processing and lodge a complaint with your data protection authority, including the Italian Garante. In-app account deletion is available under Connections > Account. Planning suggestions do not make legal or similarly significant automated decisions about you.
Changes
We update this notice when processing changes and show the updated date. Material changes will also be communicated in the app. If you believe a child has supplied information without appropriate authorization, contact support for review and removal.